Re: [PATCH v3 1/2 5.10.y, 5.15.y] Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref

> l2cap_chan_timeout() runs asynchronously and accesses chan->conn. If
> the connection is torn down while the timer is running or pending,
> chan->conn can be freed, leading to a use-after-free when the timer
> worker attempts to lock conn->lock:

Queued the series for 5.15 and 5.10, thanks.

-- 
Thanks,
Sasha